peass-ng/PEASS-ng · error · EndOfStreamException

EOF found reading length

Error message

EOF found reading length

What it means

ReadLength ran out of stream while reading the multi-byte long-form length octets: a byte read returned < 0 (EOF). The library throws EndOfStreamException because the declared length field is incomplete, so no valid DER object can follow.

Source

Thrown at winPEAS/winPEASexe/winPEAS/3rdParty/BouncyCastle/asn1/Asn1InputStream.cs:296

            if (length == 0x80)
                return -1;      // indefinite-length encoding

            if (length > 127)
            {
                int size = length & 0x7f;

                // Note: The invalid long form "0xff" (see X.690 8.1.3.5c) will be caught here
                if (size > 4)
                    throw new IOException("DER length more than 4 bytes: " + size);

                length = 0;
                for (int i = 0; i < size; i++)
                {
                    int next = s.ReadByte();

                    if (next < 0)
                        throw new EndOfStreamException("EOF found reading length");

                    length = (length << 8) + next;
                }

                if (length < 0)
                    throw new IOException("corrupted stream - negative length found");

                if (length >= limit && !isParsing)   // after all we must have read at least 1 byte
                    throw new IOException("corrupted stream - out of bounds length found: " + length + " >= " + limit);
            }

            return length;
        }

        private static byte[] GetBuffer(DefiniteLengthInputStream defIn, byte[][] tmpBuffers)
        {
            int len = defIn.Remaining;
            if (len >= tmpBuffers.Length)

View on GitHub (pinned to 53fb989abc)

Solutions

1. Verify the source data is complete (check file size, download integrity, Content-Length)
2. Ensure the stream position is at the true start of the ASN.1 object and not partially consumed
3. Re-read the blob from source; if the stream is non-seekable, buffer it fully into a byte[] first
4. Wrap parsing in try-catch for EndOfStreamException and treat input as corrupt

Example fix

// before
Asn1Object o = new Asn1InputStream(networkStream).ReadObject();
// after
byte[] all = ReadAllBytes(networkStream); // buffer fully first
Asn1Object o = Asn1Object.FromByteArray(all);

static bool StreamHasEnoughBytes(Stream s, int minBytes)
{
    return s.CanSeek && (s.Length - s.Position) >= minBytes;
}

try { Asn1Object o = new Asn1InputStream(stream).ReadObject(); }
catch (EndOfStreamException)
{
    // declared length exceeded available bytes: input truncated
}

When it happens

Trigger: Stream ends in the middle of a long-form length field (first length byte 0x81-0x84 declares N length bytes but fewer than N bytes remain).

Common situations: Truncated certificate/PFX downloads; reading from a partially transferred network stream; passing a stream already consumed by a previous parser; cut-off log-embedded blobs.

Related errors

• EOF encountered in middle of BMPString
• unknown object encountered in constructed OCTET STRING:
• unknown tag {tagNo} encountered
• DER length more than 4 bytes:
• corrupted stream - negative length found

AI-assisted analysis of peass-ng/PEASS-ng@53fb989abc (2026-09-02). Data as JSON: /api/errors/5cc4b26b26ef7bbf. Report an issue: GitHub.